Data protection questions to ask before a GEO engagement

Ask whether personal data is needed at all

A GEO audit can often begin with public webpages, approved organisation facts, technical evidence, buyer questions and aggregated performance reports. A supplier should not receive user-level analytics, enquiry records, student or customer files, inbox access or unrestricted exports merely because those datasets exist.

The UK GDPR principles include purpose limitation, data minimisation, storage limitation, security and accountability. The buyer should therefore identify the delivery decision first, then ask for the least data capable of supporting it. Aggregated counts, redacted examples, a restricted view or a buyer-run export may answer the question without transferring identifiable information.

Complete an eight-part supplier due-diligence record

Record one answer for each processing activity rather than accepting a general statement that the supplier is GDPR compliant. The exact legal position depends on the facts, so the buyer's data protection lead or legal adviser should confirm the roles and safeguards for the engagement.

Match the contract to the real processing

When a controller uses a processor, the ICO says there must be a written contract or other legal act containing the required Article 28 terms. These cover documented instructions, confidentiality, security, sub-processors, assistance with individual rights and other controller duties, end-of-contract return or deletion, and audits or inspections.

A data-processing schedule should describe the subject matter, duration, nature and purpose of processing, the types of personal data and categories of people, and the controller's rights and duties. It should match the actual GEO workflow: what is supplied, where it is viewed, which outputs are returned, who approves changes, and what happens to copies and credentials at exit. A generic privacy policy is not a substitute for activity-specific instructions.

• Name the approved systems and data boundaries rather than authorising “all website data”.
• Separate public content research from processing of identifiable analytics or enquiry data.
• State whether supplier material may be used for any independent purpose, including product improvement or model training.
• Require prior approval or a controlled notice process for relevant sub-processor changes.
• Define incident escalation, evidence preservation and the information the buyer must receive.
• Choose return or deletion at exit and specify how backups are placed beyond use and later deleted.
• Retain the buyer's right to obtain information needed to demonstrate compliance and to conduct proportionate assurance.

Map international access before work starts

The ICO's international-transfer guidance treats both sending personal information and making it accessible to a separate organisation outside the UK as potential transfers. Buyers should map the legal entities, hosting and support locations, administrator access and sub-processors before deciding whether a restricted transfer occurs.

Where the buyer initiates a restricted transfer, the ICO's checklist asks whether UK adequacy regulations apply or whether an appropriate safeguard and, where required, a transfer risk assessment are needed. An exception is not a routine procurement shortcut. The supplier should provide facts about the flow; the buyer remains responsible for deciding which mechanism applies to its circumstances.

Run a practical acceptance test

Before access is granted, ask the supplier to return the completed record, data-flow map and contract schedule. Select a sample processing activity and trace it from source to access, output, retention and deletion. The answer passes only if the business purpose, minimum dataset, identities, locations, sub-processors, transfer position, incident route and exit evidence can all be identified without relying on unwritten assumptions.

During delivery, review the record when the question set, data source, market, language, system, supplier personnel or sub-processor changes. At exit, revoke access, collect buyer-owned outputs, obtain deletion or return evidence and record any backup period. A signed contract without operational evidence is not a complete control.

How SALIENS can support a data-minimised GEO scope

SALIENS provides GEO audits, AI visibility monitoring, content and technical improvements, and ongoing GEO delivery. We can begin with public content, approved fact sheets, aggregated observations or buyer-produced exports where these are sufficient, then document any narrower access or additional data needed for an agreed deliverable.

Email info@oxfordintelligence.co.uk with your website, target markets and languages, proposed scope, available data sources, access constraints and internal approvers. SALIENS is operated by Oxford Intelligence Limited. This guide is a procurement checklist, not legal advice; processing roles and transfer requirements must be assessed for the specific engagement. Data access does not guarantee crawling, indexation, AI mentions, citations, rankings, traffic or enquiries.